Crossplane package manager (cosign signature verification via ImageConfig): SUPPLY CHAIN, TIME-OF-CHECK TO TIME-OF-USE

Impact

SUPPLY CHAIN, TIME-OF-CHECK TO TIME-OF-USE: Crossplane verifies a package's signature and then installs a different package. When a package is referenced by tag rather than digest, the package manager resolves that tag separately for the verification step and for the pull step, so a malicious registry serves a correctly signed image to the verifier and an unsigned one to the installer. Signature verification reports success and unsigned attacker code lands in the cluster with whatever privileges the Crossplane package holds — and Crossplane packages are control-plane extensions that reconcile cloud and infrastructure resources, so that is typically broad. The failure mode is the worst kind for an operator: the control is enabled, the dashboard is green, and it is providing no protection.

Who can reach it

Network, unauthenticated from the attacker's side: requires a malicious or compromised OCI registry able to vary what it serves per request. Only affects users who enable signature verification, install by tag rather than digest, and pull from registries they do not control.

What to do

Install packages by image digest rather than tag — this defeats the race entirely and is the vendor's stated mitigation as well as general best practice. Upgrade to Crossplane 2.3.3 or 2.2.3, where the tag is resolved once and the resulting digest is used for both verification and fetch. Note the maintainers are not backporting to 1.20, so 1.20 clusters must rely on digest pinning permanently.

References